CVE-2024-26654

What it actually does

Use-after-free in ALSA sh:aica driver caused by timer/worker thread race on aica_channel deallocation during PCM close when del_timer returns without waiting for pending handlers and schedule_work can still fire.

Why it matters to the business

Kernel memory corruption on systems using the affected Dreamcast audio hardware can lead to crashes, denial of service, or potential local privilege escalation; low public exploit activity reduces immediate ransomware risk but still requires prompt patching on embedded or legacy Linux audio devices.

How an attack unfolds

An attacker with local access opens a PCM substream, triggers concurrent worker and timer activity, then closes the stream; the close path frees the channel while a rescheduled worker still dereferences it, causing the UAF.

How to fix it

Update the Linux kernel to commit eeb2a2ca0b8de7e1c66afaf719529154e7dc60b2 or later stable releases that include the conditional mod_timer change and PCM sync_stop implementation; rebuild and reboot affected systems.

How to confirm the fix worked

Confirm kernel source contains the sync_stop PCM operation and the conditional mod_timer guard in run_spu_dma; run regression tests exercising PCM open/close under load on aica hardware; verify no UAF reports in kernel logs during shutdown sequences.

Typical attack path

1. Obtain local code execution on affected Linux system
2. Open ALSA PCM substream on aica device
3. Trigger run_spu_dma worker and mod_timer path
4. Call snd_aicapcm_pcm_close while worker/timer still active
5. Trigger dereference of freed dreamcastcard->channel in worker

How to detect it

Review kernel logs for UAF warnings or oops involving aica, dreamcastcard, or spu_dma_work around PCM close operations; inspect auditd or syscall logs for unusual ALSA PCM open/close sequences from untrusted processes.

What your security team should do

• Prioritize kernel upgrade on any device exposing aica ALSA hardware within 30 days
• Audit custom kernels or downstream distributions for backport of the referenced commit
• Monitor for local privilege-escalation attempts on embedded Linux audio platforms